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We propose a new approach to implement quantum repeaters for long distance quantum com- 
munication. Our protocol generates a backbone of encoded Bell pairs and uses the procedure of 
classical error correction during simultaneous entanglement connection. We illustrate that the re- 
peater protocol with simple Calderbank-Shor-Steane (CSS) encoding can significantly extend the 
communication distance, while still maintaining a fast key generation rate. 

PACS numbers: PACS number 



I. INTRODUCTION 

Quantum key distribution generates a shared string of 
bits between two distant locations (a key) whose secu- 
rity is ensured by quantum mechanics rather than com- 
putational complexity [T| . Recently, quantum communi- 
cation over 150 km has been demonstrated 2=, but the 
key generation rate decreases exponentially with the dis- 
tance due to the fiber attenuation. Quantum repeaters 
can resolve the fiber attenuation problem, reducing the 
exponential scaling to polynomial scaling by introducing 
repeater stations to store intermediate quantum states 
[3 SI H] . Dynamic programming-based search algorithm 
can optimize the key generation rate and the final-state 
fidelity of the quantum repeaters [6]. Using additional 
local resources (i.e., more quantum bits per station), the 
key generation rate can be further improved by multi- 
plexing different available pairs [7 and banding pairs ac- 
cording to their fidelities [8 . However, since all these pro- 
tocols use entanglement purification that requires two- 
way classical communication, the time to purify pairs 
increases with the distance and all these protocols are 
relatively slow. Thus, the finite coherence time of quan- 
tum memory ultimately limits the communication dis- 
tance 0. As illustrated in Fig. [l] the estimated key 
generation rate sharply decreases as soon as the memory 
error becomes dominant. 

Here we propose a new, fast quantum repeater proto- 
col in which the communication distance is not limited by 
the memory coherence time. Our protocol encodes log- 
ical qubits with small CSS codes [10], applies entangle- 
ment connection at the encoded level, and uses classical 
error correction to boost the fidelity of entanglement con- 
nection. We eliminate the time-consuming entanglement 
purification operation over long distances and also avoid 
the resource-consuming procedure of quantum error cor- 
rection. We find that the new repeater protocol with 
small CSS codes can extend the communication distance 
(10"^ ~ 10^ km) and maintain an efficient key genera- 
tion rate (above 100 bits/sec) using finite local resources 



(30 ^ 150 qubits/station) that scale logarithmically with 
distance. 

In Sec. [IT] we describe the idealized quantum repeater 
protocol to overcome the fiber attenuation problem, em- 
phasizing the possibility of simultaneous entanglement 
connection and pointing out three other major imper- 
fections (entanglement infidelity, operational errors, and 
memory errors) that still needs to be suppressed. In 
Sec. HI we consider an example of quantum repeater 
with repetition code to suppress the bit-flip errors. In 
Sec. |IV[ we provide the general protocol for quantum 
repeater with CSS code that can suppress both bit-flip 
and dephasing errors. In Sec. |Vj we compute the final 
fidelity achievable with our protocol, which in principle 
can be arbitrarily close to unity using large and efficient 
CSS code. In Sec. VI we calculate the maximum number 



of connections depending on the code and the imperfec- 
tions, and we also estimate the key generation rate. In 
Sec. |VII[ we discuss potential improvements and other 
applications. 



II. FAST QUANTUM COMMUNICATION 
WITH IDEAL OPERATIONS 



We start by describing an idealized quantum repeater 
protocol, where fiber attenuation is the only problem to 
be overcome. As illustrated in Fig. |2] there are L re- 
peater stations, and the separation between the neigh- 
boring stations is of the order of the fiber attenuation 
length. The Bell pairs |$+) = ^ (|0) |0) |1) |1)) be- 
tween neighboring repeater stations are independently 
generated and verified. Then entanglement connection 
(swapping) \TT, TS] is applied to connect these Bell pairs 
into a long Bell pair. Each intermediate repeater station 
measures the two local qubits in the Bell basis (called 
Bell measurement, see the inset of Fig. [2]) and announces 
2 classical bits of information, which uniquely specify the 
four possible measurement outcomes and enables the de- 
termination of the Pauli frame for the remaining qubits 
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FIG. 1: Comparison between the conventional and new re- 
peater protocols, in terms of the generation rate of Bell pairs 
or secret bit pairs (i.e., the sustained bandwidth of the re- 
peater channel). The memory coherence time is assumed to 
be tcoh = 10 sec, and the nearest neighbor spacing is Iq — 10 
km. (i) The blue curve is the BDCZ protocol (with the maxi- 
mum number of qubits per station increasing logarithmically 
with distance, see scheme C in Ref. [TT]). The sharp de- 
crease in rate is attributed to blinded connection and purifi- 
cation [3] when the memory error becomes dominant (i.e., 
time > O.OItcoIi = 0.1 sec), (ii) The red dashed curve is 
the parallel protocol (with the number of qubits per station 
increasing at least linearly with distance, see scheme B in 
Ref. |11)). (iii) The black dotted reference curve is the inverse 
of the classical communication time between the final stations. 
Since all conventional repeater protocols rely on two-way clas- 
sical communication, their rates always stay below the refer- 
ence curve unless parallel or multiplexed [8] repeater channels 
are used, (iv) The orange horizontal thick line is our new re- 
peater protocol with encoding (with the number of qubits per 
station increasing logarithmically or poly-logarithmically with 
distance). Since our protocol runs in the one-way communi- 
cation mode, the rate is independent of the communication 
distance, and can reach above the black dashed curve. Our 
protocol is much more efficient over long distances than con- 
ventional protocols. 



(i.e., the choice of local Pauli operators that adjust the 
long Bell pair to 1$^) \)Ai)- This is a deterministic 
process requiring local operation and (one-way) classical 
communication. 

The entanglement connection can be applied simulta- 
neously ^ for all intermediate stations, because the quan- 
tum circuit for Bell measurement does not depend on 
the Pauli frame. It is the interpretation of the measure- 
ment outcome that depends on the Pauli frame. Fortu- 
nately, we can wait until we collect all 2(L — 2) announced 
classical bits from intermediate stations, and decide the 
Pauli frame for the final distant Bell pair. In addition. 




FIG. 2: Idealized quantum repeater. There are L = 5 re- 
peater stations. Each intermediate station has two physical 
qubits. Step 1. (Generation) Bell pairs between neigh- 
boring repeater stations are generated. Step 2. (Connec- 
tion) The qubits at the intermediate stations arc measured in 
the Bell basis (see the inset). Step 3. (Pauli Frame) The 
Pauli frame for qubits at the outermost stations is determined, 
based on the outputs of intermediate Bell measurements. Fi- 
nally, one remote Bell pair between the outermost stations is 
created. 



without compromising the security for quantum key dis- 
tribution, the two final (outermost) stations can mea- 
sure their qubits in random X and Z basis and announce 
their choices of the basis even before receiving classical 
bits from intermediate stations. Half of the time, they 
will find that they choose the same basis (in the Pauli 
frame) and obtain strongly correlated measurement out- 
comes that can be used for secret keys [15]. Thanks to 
the simultaneous entanglement connection, the idealized 
quantum repeater can be very fast and the cycle time 
Tc is just the total time for entanglement generation and 
connection between neighboring repeater stations. 

In practice, however, there are three major imperfec- 
tions besides the fiber attenuation. (1) The generated 
entangled state p between neighboring repeater stations 
is not the perfect Bell state 1$^), characterized by the 
entanglement fidelity 



Fo = ($+1 < 1. 



(1) 



(2) The local operations for entanglement connection 
have errors [31 HI [5] H]. For example, the local two-qubit 
unitary operation Uij would be 



(l-/3)C/,,pC//, + ^Tr„-[p]®/,,, (2) 



where P is the gate error probability, Tr^^ [p] is the partial 
trace over the subsystem i and j, and lij is the identity 
operator for the subsystem i and j. The projective mea- 
surement of state |0) would be 



= (1 - 6) 



<5|1)(1| 



(3) 



^ We use the rest frame of the repeater stations. 



where S is the measurement error probability. (3) The 
quantum memory decoheres with rate 7. We model the 
memory error probability for storage time Tc as ^ = 1 — 



3 



e '•''^^ « 7Tc. The action of the memory error on the zth 
qubit would be 



p^(l-M)p+^Tr, [p]® J, 



(4) 



where Tr^ [p] is the partial trace over the subsystem i, 
and li is the identity operator for the subsystem i. 

In the following two sections, we will present the new 
repeater protocol. Our new repeater protocol replaces 
the physical qubits (in Fig. [2| with encoded qubits (in 
Fig. [3]), generates the encoded Bell pairs between neigh- 
boring stations, connects the encoded Bell pairs at in- 
termediate stations simultaneously, and determines the 
Pauli frame for the encoded Bell pair shared by the final 



stations. In Sec. Ill we provide an illustrative example of 
quantum repeater with 3-qubit repetition code that can 
fix only bit-flip errors. In Sec. |IV| we propose our new 
protocol with CSS codes that can fix all imperfections 
listed above. 



III. QUANTUM REPEATER WITH 
REPETITION CODE 



To illustrate the idea, we first consider an example that 
uses the 3-qubit repetition code to encode one logical 
qubit 



|0) = |000) and |i) = |lll), 



(5) 



which can fix one bit-flip error. Although it cannot fix 
all the errors given in Sec.|ll] this example illustrates all 
other key elements of the new repeater protocol and it 
can be easily generalized to the CSS encodes that can fix 
all the errors as discussed in Sec. IIVI 
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First, we generate the encoded Bell pair <I>^ 

^ 10)2 + Ivi 1^2) between neighboring stations 1 
and 2, as illustrated in the upper- left panel of Fig. |3] 
We need at least six qubits from each station: three 
for memory qubits (blue dots) and three for ancillary 
qubits (gray dots). There are three steps: (i) We lo- 
cally prepare the encoded state ^ + |0)2 
and store them in the memory qubits (in blue squared 
boxes); (ii) we generate three copies of the physical Bell 

(10^ 10^ +11^ 11^ \ 
^ ^ ^ j between ancillar qubits (gray 

lines); (iii) we use the entanglement resources of 3 phys- 
ical Bell pairs to implement 3 teleportation-based CNOT 
gates |16 } I17| , [T8]. applied transversally between the mem- 
ory qubits storing the encoded states ^ (P);^ + 

and 10)2: 



V2 



(|000)i + |111)J ® |000). 



V2 



(|ooo), 1000)2 + |111)J111)2) 



(6) 
(7) 



which gives us exactly the desired encoded Bell pair 

) . Similarly, we can generate encoded Bell pairs 
/ 12 

) between neighboring stations j and j + 1, 
2,--- ,L-1. 



for 



and 
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Then we connect the encoded Bell pairs 
) to obtain the longer encoded Bell pair 

/ 23 

The idea is to perform the encoded Bell measurement 
over the two encoding blocks at station 2. We use 2a 
and 26 to refer to the left and the right encoding blocks 
at station 2, respectively. As shown in Fig. |3] (see step 2 
and the lower- left panel) , we apply three pairwise CNOT 
gates between the two encoding blocks {at} and {hi} at 
station 2. To see the possible outcomes of this procedure, 
we rewrite the initial state in terms of Bell states between 
stations 1 and 3, 



_1 
~2 

1 

^2 
where 



1,2a 



26,3 





$+\ + 


(8) 
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72(|0)l|0)3±|l)l|l)3)' 
72(10)1 11)2 ±|l)l 10)2)' l±)2a - 75(l^)2a±|l)2a)- 

To complete the encoded Bell measurement, we projec- 
tively measure the logical qubits of these two encoding 
blocks as follows: (1) The logical qubit for 2a should be 
measured in the {|i)} basis, which can be achieved by 
measuring the physical qubits {ai} in the {|±)} basis. 
Since 1+) = i (1+ + +) + 1+ - -) + I- + -) + I- - +)) 

and p) = i(| ) + I- ++) + !+ -+) + !+ + -)), 

there will be an odd number of |+) outputs if the en- 
coded qubit is in state |+), and an even number of |-|-) 
outputs if the encoded qubit is in state |-). (2) The 

logical qubit for 26 should be measured in the {|o) , 
basis, which can be achieved by measuring the physical 
qubits {hi} in the {|0) , |1)} basis. There should be three 
|0) outputs for state |0), and three |1) outputs for state 
The pairwise CNOT gates and projective measure- 
ment of physical qubits are summarized in the lower-left 
panel of Fig. |3] 

We now show the suppression of bit-fiip errors due to 
the repetition code [Eq. (|5|]. If one of the physical qubits 
in 26 is bit-fiipped, the measurement outcomes for 26 will 
contain two correct outputs and one erroneous output. 
Choosing the majority output, we can identify and cor- 
rect the erroneous output, and still obtain the logical bit 
encoded in 26 correctly. We emphasize that only classical 
error correction is used. If there is one physical qubit in 
2a that suffers from a bit-flip error, this error will not 
affect the outputs for 2a, as bit-flip errors commute with 
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FIG. 3: Repeater protocol with encoding. Each repeater station has 2n memory qubits (blue dots) and O (n) auxiliary qubits 
(gray dots). Here n = 3. Step 1. (Encoded Generation) Between two neighboring stations (upper-left panel); (i) memory 
qubits are fault-tolerantly prepared in the encoded states |0) or |+) ~ (|0) + (ii) purified physical Bell pairs are 

generated between auxiliary qubits (connected gray dots), (iii) an encoded Bell pair j*!"^^ = ^ (|6)a \^) b "'^ I-'-)4 \ ^) b) 
between neighboring stations is created using encoded CNOT gate (achieved by n pairwise, teleportation-based CNOT gates 
[161 1171 \T8\ ). Step 2. (Encoded Connection) Encoded Bell measurements are simultaneously applied to all intermediate 
repeater stations, via pairwise CNOT gates between qubits and bi followed by measurement of the physical qubits (the 
lower-left panel). Using classical error correction, the outc omes for the encoded Bell measurement can be obtained with a very 
small effective logical error probability Q ~ q^'^^ [Eq. (11 1]. The outcome is announced as 2 classical bits (purple star) at each 



intermediate repeater station. Step 3. (Pauli Frame) According to the outcomes of intermediate encoded Bell measurements, 
the Pauli frame [14] can be determined for qubits at the outermost stations. Finally, one encoded Bell pair between the final 
(outermost) stations is created. 



the operators to be measured; this error may affect one 
corresponding physical qubit in 26, which can be identi- 
fied and corrected using the majority. Therefore, we can 
obtain the logical outcomes for both 2a and 26, and the 
suppressed effective logical error probability can be 



The final stations share the encoded Bell pair ) = 

/ IL 

(|0)i 16)2, + |l)i whose Pauh frame is deter- 

mined by the 2{L — 2) announced classical bits from all 
intermediate stations. 



Q 



4 



(8) 



where (jb < 4/3 + 25 + /i is the effective error probability 
for each bi to give the wrong output (Appendix. [A|. 

To complete the entanglement connection, station 2 
announces the outcomes for its two logical qubits from 
the encoded Bell measurement, which contains two clas- 
sical bits of information and determines the Pauli frame 
for the encoded Bell pair shared between stations 1 and 
3. Note that the detailed outputs of physical qubits 
are only important to obtain the logical outcomes, but 
not needed for communication among stations. Simi- 
larly, we can perform entanglement connection for all 
the intermediate stations. Furthermore, these entan- 
glement connections can still be applied simultaneously 
for all intermediate striations, as described in Sec. ITTl 



IV. QUANTUM REPEATER WITH CSS CODE 

In this section, we will generalize the repeater protocol 
from the 3-qubit repetition code to any [[n, k, 2t + 1]] 
CSS code |10j . which encodes k logical qubits with n 
physical qubits and fixes up to t (bit-flip and dephasing) 
errors. For simplicity, we will focus on the CSS codes 
with fc = 1, which includes the well studied [[5,1,3]], 
[[7,1,3]] (Steane), and [[9,1,3]] (Shor) codes. Extension 
of the protocol to A: > 1 is straightforward. The CSS code 
can be regarded as a combination of two classical error 
correcting codes and , which fix dephasing errors 
and bit-blip errors, respectively. The error syndromes 
for the code (or C^) can be obtained if we have the 
outputs for the n physical qubits measured in the X (or 
Z) basis. 
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The relevant properties of the CSS codes are summa- 
rized as follows: (1) The measurement of logical opera- 
tor X (or Z) can be obtained from projective measure- 
ment of physical qubits in the X (or Z) basis. (2) The 
outputs from measurements of physical qubit in the X 
(or Z) basis should comply with the rules of the clas- 
sical error correcting code C-^ (or C^), which can fix 
up to (or t^) errors in the n output bits. (For ex- 
ample, the 3-qubit repetition cod can fix up to — \ 
bit- flip error as discussed in Sec. Ill ) Suppose each out- 
put bit has an (uncorrelated) effective error probability 
g ~ /3 + (5 -|- /J,, after fixing up to t errors the remaining 
error probability for the logical outcome is O (g*"''^), as- 
suming t = min {t^,t^}. (3) The encoded CNOT gate 
can be implemented by n pairwise CNOT gates between 
two encoding blocks [TU]. Such pairwise CNOT gates do 
not propagate errors within each encoding block, and it 
can be be used for preparation of encoded Bell pairs. 

We find that each repeater station needs approxi- 
mately 6n physical qubits (see Appendix [b] for details), 
including 2n memory qubits to store the two encoded 
qubits that are entangled with the neighboring stations, 
and approximately An ancillary qubits for the fault- 
tolerant preparation of the encoded qubits and genera- 
tion of non-local encoded Bell pairs between neighboring 
repeater stations. There are three steps for each cycle of 
the new repeater protocol: 

1. Generate encoded Bell pairs between two neigh- 
boring stations (see the upper-left panel of Fig. [s]): (i) 
We initialize the memory qubits in logical states |0) and 
^ (|6) -|- at each station fault-tolerantly (with er- 
rors effectively uncorrelated among physical qubits from 
the same encoding block) ^. (ii) We use entanglement 
purification to obtain purified Bell pairs between two 
neighboring stations [TT]. Each purified Bell pair can 
be immediately used for a teleportation-based CNOT gate 
[16, n , 18 . (iii) According to the property (3) of the CSS 
code, we need n teleportation-based CNOT gates to im- 
plement the encoded CNOT gate and obtain the encoded 



Bell pair 



J+1 



be- 



tween neighboring stations j and j + 1. 

2. Connect the encoded Bell pairs, performing encoded 
Bell measurement at all intermediate stations simultane- 
ously (see step 2 of Fig. [3]). At each intermediate station, 
we first apply the pairwise CNOT gates between qubits 
ai and hi, with from the control block and hi from the 
target block, for i = 1, • • • , n (as shown in the lower- left 
panel in Fig. [3|. Then we projectively measure the phys- 



ical qubits in the X basis for ai and in the Z basis for hi. 
According to the property (2) of the CSS code, we can 
use the classical error correcting code (or C^) to fix 
up to t errors in {ai} (or {hi}), leaving only O (g*"''"'^) for 
the logical error probability. Thus, the outcomes for the 
encoded X and Z operators of the encoded Bell measure- 
ment can be obtained with high accuracy of ©(q*"*"^). 
Similar to the idealized repeater, each intermediate re- 
peater station announces 2 classical bits of information 
of the encoded Bell measurement. 

3. According to the 2(L — 2) announced classical bits 
from all intermediate repeater stations, choose the Pauli 
frame at the final repeater stations for the shared encoded 
Bell pair. 



V. ERROR ESTIMATE 

In order to calibrate the encoded Bell pair obtained 
from the new repeater protocol, we need to generalize the 
definition of entanglement fidelity, because the encoding 
enables us to correct small errors that deviate from the 
logical subspace. We define the entanglement fidelity as 



F ■ 



na,BcllJ 



(9) 



where TZ represents the (ideal) recovery operation with 
quantum error correction |19j . The entanglement fidelity 
F can calibrate the security for the protocol and bound 
the maximum information leaked from the final stations 
^ . F can also be practically obtained from the corre- 
lation measurement between the final repeater station 
(Appendix [C|. 

We emphasize that the property of fault-tolerance can 
be maintained throughout the entire repeater protocol 
(fault-tolerant initialization, transverse CNOT gate, and 
encoded qubit measurement), so the errors for individual 
physical qubits are effectively uncorrelated. With some 
calculation (see Appendix. [A|, we estimate that the ef- 
fective error probability (per physical qubit) is 



(10) 



Note that q does not explicitly depend on Fq, because for 
level-m purified Bell pairs (see Appendix |d]) the opera- 
tional errors (/3 and 5) dominate the super-exponentially 

suppressed infidelity approximately (1 — i*o) . Then 
the effective logical error probability for each encoding 
block (caused by more than t errors from the encoded 
block) is 



^ We can achieve fault-tolerant preparation of the logical state |o) 
(or 1+)) by two approaches. One approach uses several copies of 
the logical states to distill a purified logical state with negligible 
contribution from initial correlated errors [28| . Alternatively, we 
may start with |0}®" (or |-|-}®"), projectively measure the x- 
stabilizers using fault-tolerant circuit, and update the stabilizers 
during entanglement connection. See Appendix [B| for details. 



n 
t+1 



(11) 



^ According to Ref . |31| , if the two final stations share a Bell pair 
with fidelity F = 1 — 2"" , then Eve's mutual information with the 
key is at most 2-" + 2°'--^''^ where c = s-logj (2 -|- s -|- 1/ In 2). 
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FIG. 4: From Eqs. ( |11|13| ), the maximum number of con- 
nections L* is estimated as a function of the effective error 
probability q, assuming F* = 0.95, for various CSS codes [5D] 
listed in Table |l] For q < 0.03, L* scales as l/g*+^ 



where the approximation requires small q. Since any log- 
ical error from the repeater stations will affect the final 
encoded Bell pair, the entanglement fidelity is 



2L 



(12) 



with infidelity 1 — F k 2LQ for small Q. 

For large codes, we may evaluate Eq. pT| under the 
assumptions n ^ t ^ 1. Approximating the combinato- 



7iq 



t + 1 



rial function in this limit yields Q w ^/^^ i t+i 
which indicates that for large codes with n oc t, Q can be 
arbitrarily small when q Qc ^ linin.t^oo ,iiwL„ ■ Nu- 



merically, we can evaluate the complete sum in Eq. ( 11 ) 
and we find qc ~ 5%, which corresponds to ~ 1% per-gate 
error rates. In addition, CSS codes with n < 19t exist 
for arbitrarily large t (according to the Gilbert- Varsharov 
bound, see Eq. (30) in Ref. [SI]). Therefore, our new 
repeater protocol with encoding provides a scalable ap- 
proach for long distance quantum communication. 



VI. EXAMPLE IMPLEMENTATIONS 

We now consider the implementation of the new re- 
peater protocol. Given the effective error probability q 
and the target fidelity F* , we can use Eq. ( 12 ) to calcu- 
late the maximum number of connections 



L* 



InF* 



In (1 - Q) ■ 



(13) 



This provides a unitless distance scale over which Bell 
pairs with fidelity F* can be created. According to 
Eqs. pHT3| , we can estimate L* as a function of q, which 
is plotted in Fig. |4] assuming F* — 0.95 for various CSS 
codes. Since L* scales as for q < 3%, we can sig- 

nificantly increase L* by considering efficient quantum 





Code 


Resources 


Distance 


[[n,k,2t + l]] 


(qubits / station) 


(km) 


No encoding 


~ 


4 


180 


Repetition-3 


[3,1,3] 


18 


1.0 X 10" 


Repetition-5 


[5,1,5] 


30 


1.0 X 10^ 


Hamming 


[[7,1,3]] 


42 


1.4 X 10^ 


Bacon-Shor 


[[25,1,5]] 


150 


4.3 X 10^ 


Golay 


[[23,1,7]] 


138 


3.7 X 10^ 


BCH 


[[127,29,15]] 




4.0 X 10'^ 


QR 


[[103,1,19]] 




2.4 X 10" 



TABLE L Local resources, and maximum communication dis- 
tance for the new repeater protocol. In the case of no en- 
coding, each station has 2 qubits for entanglement connec- 
tion, and 2 additional qubits for entanglement purification to 
obtain high-fidelity purified Bell pairs. For repetition codes 
(with single square bracket), only one type of errors (bit-flip 
or dephasing) can be suppressed. For other CSS codes (with 
double square brackets), both bit-flip and dephasing errors 
can be suppressed. The local resources are estimated to be 
6n qubits for each station (Appendix [b|. The distance is es- 
timated from Eqs. ( 11|13 1, assuming parameters q — 0.3%, 
F* = 0.95 and lo = 10 km. 



codes with large t. For example, given q = 0.3%, we 
estimate the maximum number of connections L* w 9, 
1.4 X 10^, and 3.7 x 10^ for cases of no encoding, [[7, 1, 3]] 
Hamming code, and [[23,1,7]] Golay code, respectively. 
If we choose the nearest neighbor spacing to be Iq — 10 
km (about half the fiber attenuation length), the corre- 
sponding maximum distances will be 90 km, 1.4 x 10"^ km, 
and 3.7 x 10^ km. The new protocol can easily reach and 
go beyond intercontinental distances. In Tablejl] we sum- 
marize the local resources and maximum communication 
distance for the new protocol with different encoding. 

Besides maximum distances, we also estimate the key 
generation rate, which is the inverse of the cycle time 
for the new protocol. For fast local operations (systems 
such as ion traps p2t 123] and NV centers [24l [25] can 
achieve almost MHz rate for local operations), the cycle 
time is dominated by creating purified Bell pairs between 
neighboring stations 



Iq e'f/'"" 
V r]^ 



(14) 



We find that Tc ~ 0.9k ms, given the parameters of 
Iq = 10 km, the fiber attenuation length latt ~ 20 km, the 
signal propagation speed u « 2 x 10'^ km/s, and the over- 
all efficiency for collecting and detecting single photon 
rj w 0.3. The dimensionless pref actor k is the time over- 
head to ensure that n purified Bell pairs are obtained 
between neighboring stations. Since there are approxi- 
mately 4rt ancillary qubits for entanglement generation 
at each station, the rate to generate unpurified Bell pairs 
also increases with n. Thus, k is not sensitive to the 
choice of n. As detailed in Appendix |D] we estimate 
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K « 8 for /3 = (5 = 10~^ and Fq = 0.95 with depolariz- 
ing error, and the purified pair has fidehty 0.9984 after 
three levels of purification. Therefore, for the parameters 
considered here, approximately 6n qubits at each station 
can achieve Tc ~ 7 ms, which is sufficient for quantum 
key generation rate of 100 bits/sec over long distances. 

VII. DISCUSSION 

Our new repeater protocol is significantly faster than 
the standard repeater protocols over long distances j3j 
SI 13 IS] J because the time-consuming procedure of entan- 
glement purification of distant Bell pairs is now replaced 
by local encoding with simple CSS code and classical er- 
ror correction. The new protocol runs in the one-way 
communication mode, so the key generation rate is inde- 
pendent of the communication distance, and only limited 
by the cycle time for encoded Bell pair generation and 
entanglement connection. The key generation rate can be 
further improved by having higher efficiency rj, improved 
fidelity Fq, smaller separation between stations Iq, and 
more qubits per repeater station. In addition, the rate 
can also be increased by using CSS codes with fc > 1 (e.g., 
the [[127,29,15]] BCH code mentioned in Fig. [i]), along 
with a small modification to the protocol that each in- 
termediate station sends 2k classical bits associated with 
k Bell measurements. 

Asymptotically, CSS codes with n < 19t exist for ar- 
bitrarily large t [obtained from the Gilbert- Varsharov 
bound, see Eq. (30) in Ref. USl Thus, the effective 
logical error probability Q [Eq. ( |11[ )] can be arbitrarily 
small for q < 5%, and n oc t In L is sl small num- 
ber increasing only logarithmically with L. In practice, 
however, it is still challenging to initialize large CSS en- 
coding block fault-tolerantly with imperfect local opera- 
tions. To avoid complicated initialization, we may con- 
struct larger CSS codes by concatenating smaller codes 
with r nesting levels, and the code size scales polyno- 
mially with the code distance, n oc f ~ (InL)*^. Alter- 
natively, we may consider the Bacon-Shor code [55]; the 
encoding block scales quadratically with the code dis- 
tance n = (2t + 1) In^ L, and the initialization can be 
reduced to the preparation of {2t + l)-qubit GHZ states. 

If the imperfections are dominated by the dephas- 
ing errors, we may use the [2t -I- 1, 1, 2t -I- 1] repetition 
code [e.g., use the {2t + l)-qubit GHZ states |-|- • • • ± 
|— • ) with |±) = ^ (|0) ± |1)) to encode one logical 

qubit]. The repetition code has the advantage of small 
encoding block and efficient initialization (see Table |l]) . 
For example, given q — 0.3% and F* — 0.95, we estimate 
L* « 1.0 X 10^ and 1.0 x 10^ for 3-qubit and 5-qubit 
repetition codes, respectively. Such simple repetition en- 
coding can be useful for quantum networks as well [27] . 

Our repeater protocol can also generate high fidelity 
entanglement over long distances. For example, F* = 
0.999 and L* w 730 can be achieved with q = 0.3% and 
the [[23,1,7]] Golay code. Such high fidelity entangle- 



ment might be useful for applications such as quantum 
state teleportation and distributed quantum computa- 
tion [TB]. Since quantum circuits for state-teleportation 
or teleportation-based CNOT gate only use Clifford 
group operations, the generated entanglement can be im- 
mediately used in these circuits without waiting for the 
classical information of the Pauli frame. The adjustment 
of the Pauli frame has to be postponed until the classical 
information is received 

Suppose good quantum memory (with coherence time 
longer than the communication time) is available at the 
final stations, real distant Bell pairs (rather than just 
strings of secret bits for quantum key distribution) can 
be generated. For on-demand generation of distant Bell 
pairs, the time delay (loL/c) associated with the classical 
communication to specify the Pauli frame is inevitable, 
and the total time to create one Bell pair on-demand is 
Tc + IqL/c. For offline generation of distant Bell pairs 
that are stored in good quantum memory for later use, 
we have to assume that there are enough qubits at the 
final stations to store all Bell pair generated, while the 
number of qubits at each intermediate station remains 
unchanged. Up to the time delay {IqL/c) for the first Bell 
pair , our quantum repeater channel can create distant 
Bell pairs at the rate l/r^, again corresponding to the 
flat curve in Fig. [T] 



VIII. CONCLUSION 

In summary, we have proposed a new, fast quantum re- 
peater protocol for quantum key distribution over inter- 
continental distances. Our protocol fault-tolerantly gen- 
erates a backbone of Bell pairs with CSS encoding, and 
uses simple procedure of classical error correction dur- 
ing connection. Our protocol using simple CSS code can 
provide secure quantum communication over thousands 
or even millions of kilometers, with 0.3% effective error 
probability per physical qubit and 0.95 target fidelity for 
the final Bell pair (see Table |l| . The quantum key gener- 
ation rate can be above 100 bits/sec, only limited by the 
Bell pair generation between neighboring stations. 

We would thank Hans Briegel, Ignacio Cirac, Wolf- 
gang Diir, John Preskill, Anders S0rensen, Sebastien 
Perseguers, Frank Verstraete, Karl VoUbrecht for stimu- 
lating discussions. L.J. and J.M.T. thank Nil for the hos- 
pitality, where part of this research was done. K.N. and 
W.J.M. acknowledge support in part by MEXT, NICT, 
HP and QAP. 



* Good quantum memory with coherence time longer than the 
communication time might be needed. 
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APPENDIX A: EFFECTIVE ERROR 
PROBABILITY 

For our quantum repeater protocol, we introduce the 
effective error probability q, which estimates the odds for 
obtaining a wrong output of each physical qubit during 
entanglement connection. The effective error probability 
combines various imperfections from entanglement gen- 
eration and entanglement connection. In the following, 
we will derive the effective error probability q in terms of 
various error parameters /?, S, and fi as detailed in Sec. [Ill 

First of all, we observe that all relevant operations (lo- 
cal CNOT gates, teleportation-based CNOT gates, and 
measurements in Z ov X basis) never mix bit-flip errors 
and phase errors. For example, CNOT gates never con- 
vert bit-flip errors into phase errors. Measurements in 
the Z basis are only sensitive to bit-flip errors, but not 
to phase errors. Therefore, we can use two probabilities 
to characterize the bit-flip and phase errors, respec- 
tively. 

We will calculate these two probabilities for the phys- 
ical qubits from the operational step l(i,ii,iii) and step 2 
as illustrated in Fig. |3] For state distillation [step l(i)], 
it is possible to have = (/3/4 ^/2, /3/2 -f ^/2) 

for each physical qubit of the encoding block. For 
entanglement puriflcation [step l(ii)], it is possible to 
have {b",p") = (/3/2,/3/4) for each physical qubit of 
the physical Bell pairs. For teleportation-based CNOT 
gates [ini HZl HH] [step l(iii)], the control and target 
qubits accumulate errors from the input qubits, with 
{b'^',p'^') = (b' + 13/2, 2p' + 2p" + f3 + S) for the control, 
and {b'/\pf) = (25' + 2b" + (3 + 6,b' + (5/2) for the tar- 
get. Finally, after entanglement connection [step 2], the 
accumulated probability for obtaining a wrong output is 



q^ = b'/' + b'/' + (3/2 + 5^ —P+25 + ^l (Al) 

for measurements in the Z basis, and is 

qp=p'/' +p'/' + (3/2 + 5 = Ap + 25 + II (A2) 

for measurements in the X basis. For simplicity, we may 
just use 

q = max {q^, qp] = Ajd + 25 + ^, (A3) 
to estimate the effective error probability. 

APPENDIX B: FAULT-TOLERANT 
INITIALIZATION OF THE CSS CODE 

We now consider two possible approaches to fault- 
tolerant preparation of the logical states |0) (and |+) — 
^ (|0) + |i))) of the CSS code, using local operations 
within each repeater station. Both approaches use the 
technique of state distillation [25] . 



To facilitate the discussion, we flrst briefly review the 
stabilizer formulism for the CSS code [10l|29]. The error 
syndromes for the code can be obtained by measur- 
ing the operators {gf]-_-^ ^ , and the syndromes for 

the code can be obtained by measuring the opera- 
tors {9j'}j_^ ^ ■ The operators and commute 
[gf,gj'] = for all j and j'. The operators {gf} and 
{gft} are called the stabilizer generators. The logical 
information are stored in the subspace with -1-1 eigenval- 
ues for all stabilizer generators {gf} and {gf'}- (E.g., 
the 3-qubit repetition code is a CSS code with stabilizer 
generators {gf,.gf} = {Z1Z2, Z2Z3}; any logical state 
10) = a |0) -f /3 |l) satisfies the condition Z1Z2 |0) = |0) 
and ^2^3 10) = 10).) Note that the stabilizer generator 
g^ is a product of Z operators, and gf is a product of X 
operators. In addition, the logical operator X (or Z) for 
the CSS code can also be expressed as a product of X 
(or Z) operators. (E.g., the 3-qubit repetition code has 
logical operators X = X1X2X3 and Z = Z1Z2Z3.) 

1. First Approach 

In the first approach, we generate several copies of the 
logical states |0), which are not fault-tolerant as the er- 
rors might be correlated among qubits within each en- 
coding block. For example, one quantum gate (with error 
probability s) may induce errors in the multiple physical 
qubits; that is the probability for multi-qubit errors can 
occurs at the order of O (e) . To suppress such multi- 
qubit errors, we use the state distillation circuits (i.e., 
generalization of the entanglement purification circuits) 
to suppress both the X and Z errors. After each round 
of distillation, the correlated errors will be suppressed 
from O (e') to O (e'"*"^ -I- e^'^). The distillation operation 
does not introduce any new correlated errors. Thus af- 
ter sufficiently many rounds of distillation, the correlated 
errors can be suppressed. Meanwhile the uncorrelated er- 
rors from the distillation operations are also suppressed 
by the following distillation operations. Therefore, after 
sufficiently many rounds of distillation, the probability 
for uncorrelated errors will reach a steady value, of the 
order of (3 + 6 for each physical qubit. 

2. Second Approach 

In the second approach, we try to avoid correlated er- 
rors from the beginning. The idea is that we start with 
n physical qubits initialized in the product state lO)**", 
and projectively measure the stabilizers, which can be 
achieved fault-tolerantly using the GHZ states (as de- 
scribed in the next paragraph). We obtain a set of binary 
numbers associated with the stabilizer measurements. In 
principle, we can perform error correction to the encoding 
block to restore it to the -1-1 co-eigenstates for the stabi- 
lizers. Alternatively, we may keep track of the values for 
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the stabilizers, and take them into account throughout 
the entanglement generation and entanglement connec- 
tion (as detailed below). Finally, we use several copies 
of the encoding block with uncorrelated error to perform 
just one round of state distillation to suppress the error 
probability per physical qubits to ^ /3 + S. 

To achieve fault-tolerant measurement of the stabilizer, 
we use ^-qubit GHZ states (with I < n) that can be initial- 
ized fault-tolerantly [TU] ■ According to the standard form 
of the stabilizer code (see Ref. [10], page 470), the error 
in the value for each stabilizer is equivalent to the error of 
one physical qubit. We further improve the reliability of 
the stabilizer measurement by repeating it several times 

Since we have included the -1 eigenstates for the sta- 
bilizers, we need to generalize the encoded CNOT oper- 
ation by keeping track of the stabilizers as well as the 
logical qubits. Suppose the encoding block for the con- 
trol qubit has eigenvalues (xi,Zi) associated with the 
X and Z stabilizers, and the block for the target qubit 
has eigenvalues (x2,Z2). The outputs have eigenvalues 
(xi, Z1Z2) for the control block and (xiX2, Z2) for the tar- 
get block. Consequently, when we apply the generalized 
encoded CNOT operation to entanglement generation, 
there is additional classical communication to exchange 
the information of stabilizers between neighboring sta- 
tions, so that both stations can update the eigenvalues 
of the stabilizers for their encoding blocks. When we ap- 
ply the generalized encoded CNOT operation to entan- 
glement connection, the classical error correction need to 
take into account the eigenvalues of the stabilizers to cor- 
rect errors. Apart the these modifications, the remaining 
operations remain the same. 



3. Estimate Local Resources for Second Approach 

We now estimate the minimum number of qubits 
needed for each repeater station, which is required by 
the fault-tolerant preparation of the encoding block with 
small error probability. (For simplicity, we assume that 
local operational time is much faster than the communi- 
cation time and can be safely neglected.) We focus on the 
second scheme of fault-tolerant preparation, which first 
uses the GHZ states to projectively measure the stabiliz- 
ers and then apply state distillation to suppress individ- 
ual qubit errors. We emphasize again that both opera- 
tions of stabilizer measurement and state distillation can 
be performed fault-tolerantly. 

The local resources are split into two categories: the 
memory qubits to store two encoding blocks (2n qubits), 
and the ancillary qubits to assist fault-tolerant prepara- 
tion. The ancillary qubits should fault-tolerantly prepare 
of the GHZ state (using ughz qubits), and store ad- 
ditional two encoding blocks (2n qubits) for the 2-level 
state distillation. Altogether, there are An+ncHZ qubits 
for each station. 

We now detail the procedure of prepare the distilled 



state in the storage block 6, using two-level state distilla- 
tion with two additional blocks al and a2. First, we ob- 
tain a level-1 distilled encoding block in h (by projectively 
preparing the encoded state for al and 6, and using al 
to successfully purify b). Then we obtain another level-1 
distilled encoding block in a2 (by projectively preparing 
the encoded state for al and a2, and using al to success- 
fully purify a2). Finally, we obtain the level-2 distilled 
encoding block in h (by using a2 to successfully purify 6) . 
Generally, we can obtain a level-/ distilled block by using 
I additional blocks (i.e., / n qubits). 



APPENDIX C: ENTANGLEMENT FIDELITY 
AND CORRELATION 

There are two major sources that will reduce the en- 
tanglement fidelity for the final encoded Bell pairs. First, 
the errors from the Bell measurement from intermediate 
stations will lead to the wrong choice of the Pauli frame, 
and the probability that all L — 2 Bell measurements 
are error-free is {1 — Q)^'^^ '^\ In addition, unsuccess- 
ful local error correction for the final encoded Bell pair 
will also reduce the generalized fidelity, and the probabil- 
ity to have a successful error correction is approximately 
(1-Q)^ Therefore, we estimate that the entanglement 
fidelity to be « (1 - Qf^^"^ > (1 - Qf^- 

These two sources also affect the correlation of the se- 
cret keys. If the secret keys are obtained from the mea- 
surement in the X or Z basis, only half of the 2 (L — 2) 
classical bits from intermediate repeater stations are rel- 
evant while the other half do not affect the keys at all. 
And the probability for successful classical error correc- 
tion to infer the encoded logical qubit is of the order 
of (1 - Qy. Therefore, the correlation is approximately 
C ^{l-Qt ^Vf. 



APPENDIX D: TIME OVERHEAD AND 
FAILURE PROBABILITY FOR 
ENTANGLEMENT PURIFICATION 

We now consider the process of generating n purified 
Bell pairs between neighboring stations. We will calcu- 
late the failure probability Pfau for obtaining at least n 
purified Bell pairs using A'o unpurified Bell pairs. The 
failure probability should also depend on the fidelity of 
unpurified Bell pairs {Fq) and the error probability for 
local operations (/3 and 5). Generally, the more unpu- 
rified Bell pairs A^o, and the smaller failure probability 
Pfaii- For a given Pfaii, we can estimate the Nq and 
consequently the cycle time Tj, that determines the key 
generation rate. 
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FIG. 5: Failure probability and unpurified Bell pairs, (a) 
The failure probability Pfau decreases exponentially with the 
number of unpurified Bell pairs No (when A'^o surpasses cer- 
tain threshold), for n — 7 (red solid line) and n — 23 (blue 
dashed line), (b) For fixed PfaU, the ratio Nq/u ~ 15 for a 
wide range of n. The four curves from lower left to the up- 
per right correspond to P/^u = 10"^, 10"^ 10"^ and 10"', 
respectively. For both plots, we assume unpurified Bell pairs 
with fidelity Fo = 0.95 due to depolarizing error. The opera- 
tional error probabilities are (i = 5 = 10~^. After three levels 
of purifications, the fidelity of the Bell pair can be 0.9984. 



where is the success probability for obtaining a level- 
{i + 1) pair from two level-i pairs. Thus, the failure prob- 
ability is 

n-l 

For example, given (3 — 5 — 10"^ and Fq — 0.95 with 
depolarizing error, the fidelity for level-3 purified pair can 
be 0.9984. In Fig. [5|a), we plot the failure probability 
that decreases exponentially when iVo surpasses certain 
threshold. In Fig. |5jb), we plot Nq/u as a function of n, 
requiring fixed failure probability Pfaii (10""^, 10~^, 10~^ 
or 10"^). We note that A^q/"- ~ 15 is sufficient to ensure 
PfaU < 10"^ a wide range of n. 



2. Time Overhead and Key Generate Rate 

We now estimate the time needed to obtain n pu- 
rified Bell pairs between two neighboring repeater sta- 
tions. Each attempt of entanglement generation takes 
time lo/v, with success probability 7^2g-io/;att ^ Since 
there are ueuG (= 2n -f uqhz) qubits available at each 
station, the generation rate of unpurified Bell pairs is 

R = f 772e-'"/'»"7iB„G, (D5) 

'0 



1. Failure Probability 

In order to obtain the failure probability, we first cal- 
culate the number distribution for purified Bell pairs ob- 
tained from A^o unpurified Bell pairs. 

We distinguish the purified Bell pairs according their 
level of purification. A level-(z -I- 1) pair is obtained from 
a successful purification using two level-i pairs. Level-0 
pairs are the same as unpurified Bell pairs. Level-/ pairs 
are directly used for non-local CNOT gates. 

We introduce the number distribution | pm \ 

L J m=0,l,2,--- 

for level-i pairs obtained from iVo unpurified Bell pairs, 
with z = 0, 1, • • • ,1. The number distribution for level-0 
pairs is 



As two level-i pairs are needed for one level- (i - 
we define 



(Dl) 
1) pair, 

(D2) 

which can be used to calculate the number distribution 

for level- {i + I) pairs 



Pk 



P2k 



'P2k+1^ 



P: 



E 

j=m 



J 



p) , 



(D3) 



where the spacing between nearest stations is — 10 km, 
the fiber attenuation length is latt = 20 km, the signal 
propagation speed is u = 2 x 10^ km/s, and the overall 
efficiency for collecting and detecting single photon is i] w 
0.3. We have i? = nsncl-l x lO^sec"!. 

We can estimate the time to obtain A'o unpurified Bell 
pairs Tg — Nq / R. Since each station need to connect with 
both neighboring stations, the total cycle time is twice 
as long: 



7 Ja/Utt 

T, = 2No/R = K- 



(D6) 



with 



2iVo 

nEnG 



2No 
An 



(D7) 



where the last equality assumes ueuG ~ 4n (i.e., uqhz ~ 
2n) and No/nRi 15 to ensure Pfaii < 10~^ [see Fig.jsjb)]. 
Therefore, for the parameters considered here, approxi- 
mately 6n qubits at each station can achieve Tc ~ 7 ms, 
which is sufficient for quantum key generation rate of 100 
bits/sec over long distances. 
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